How to Respond to a Subject Access Request: A Step-by-Step Guide for UK Businesses

Short on time? Grab Trust Keith's free DSAR response templates before you start.

What Counts as a Subject Access Request (and What Doesn't)

Picture the scene. A former employee emails your general inbox: "Please send me everything you hold about me." Nobody's quite sure who should answer. By the time someone does, a week's gone.

That's a subject access request, or SAR. Sometimes called a DSAR. It's one of the most common rights under UK GDPR, and one of the easiest to fumble.

A SAR is a request from an individual for a copy of their personal data, plus some details about how you use it. The ICO's overview of subject access requests is a good starting point for the basics.

It doesn't need to look official

There's no form. No magic words. The person doesn't even need to say "subject access request". A message on LinkedIn, a comment to a manager, a note on a customer support ticket, all of these can count if it's clear they're asking for their own data.

That's why the first job is training. If your team can't spot a SAR when it lands in their inbox, your deadline is already running.

What a SAR isn't

Not every request is a SAR. Asking to delete data is an erasure request. Asking to stop marketing is an objection or an unsubscribe. Asking for company documents that don't contain the person's data isn't a SAR either. Sometimes one message contains several things at once, and you'll need to untangle them.

If you're not sure, treat it as a SAR until you've worked out what's being asked. That's safer than guessing wrong.

Deadlines and the Clock

Here's the bit people remember. One month.

You generally have one month from receiving a valid request to respond. That's one month from when it arrives in the business, not from when it reaches the right person. If the deadline falls on a weekend or bank holiday, the ICO's guidance gives you until the next working day, so check the ICO guide to subject access for how to count it.

Extensions, and their limits

You can extend by up to a further two months if the request is complex or the person has made several requests. But you need to tell them within the first month and explain why. "We're busy" doesn't count. Neither does "we couldn't find the right person".

What about the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 made some changes to the SAR rules. It confirms that you only need to carry out reasonable and proportionate searches, and it allows you to pause the clock while you wait for the person to clarify what they're asking for. Check the ICO's UK GDPR guidance and resources hub for the current guidance before you rely on either, as the provisions are being brought in in stages.

Whichever rules apply, the practical message is the same. Log the date the request arrived, and write down any decision to pause the clock.

Verifying Identity and Clarifying the Request

You don't want to hand someone's data to the wrong person. That's a breach, and a nasty one.

So yes, you can check who's asking. The test is proportionality. If a customer emails from the address you have on file, you probably don't need to ask for a passport. If someone you don't recognise asks for a lot of sensitive information, a bit more checking is reasonable.

Do it quickly, though. Delaying the request while you chase proof the person has already given you is a classic way to blow the deadline.

When the request is vague

"Everything you hold on me" is a valid request. But if you hold lots of data about the person, you can ask them to narrow it down. Maybe they only care about emails from the last year, or one particular complaint.

Two rules help here:

• Ask early, ideally within a few days of receiving the request, not three weeks in.
• Keep it a conversation, not a trap. They're allowed to say "yes, I still want everything".

If it's a request on behalf of someone else, such as a solicitor or a parent, you'll also need to check they've got the authority to ask.

Searching and Collecting the Data

This is where a scattered data landscape bites.

Personal data lives in more places than anyone remembers. The CRM, yes. But also support tickets, email inboxes, Slack, shared drives, spreadsheets, call recordings, HR systems and the platforms run by your suppliers. At a growing scale-up, nobody has the full picture in their head.

The businesses that cope best have done the groundwork. If you've got an up-to-date record of processing, you already know which systems hold what. If you haven't, a SAR becomes a treasure hunt. Trust Keith's guide to building and maintaining a ROPA is a good place to start.

A simple search checklist

• Systems, list every place the person's data might sit, including supplier platforms.
• Search terms, name, email address, phone number, customer or employee ID.
• People, who might hold notes or emails about them outside the main systems?
• Suppliers, ask your processors to help, and check your contracts say they must.
• A log, record where you looked, what you found, and anything you decided not to search.

That last one matters more than it sounds. If the person complains, being able to show a sensible, documented search is your best defence.

A tried and tested process makes this far less painful. Trust Keith's free DSAR process workflow lays out who does what, and when.

Exemptions and Redaction

You don't have to hand over absolutely everything. But you do need a reason for what you hold back.

The exemptions sit in the Data Protection Act 2018, and they're narrower than people hope. Some of the ones that come up most:

• Other people's data, if disclosing would reveal information about someone else, you'll need to weigh up whether it's reasonable to share, or redact it.
• Legal professional privilege, advice from your lawyers about a dispute can often be withheld.
• Confidential references, ones you've given about the person, in certain circumstances.
• Management forecasting and negotiations, where disclosure would harm those activities.

Be wary of using exemptions as a shortcut. Each one has conditions, and the decision is made document by document, not file by file. "It's embarrassing" isn't an exemption.

Redaction without the chaos

Redaction is where things go wrong. Black boxes that can be copied out of a PDF. Names left in the file properties. A comment thread nobody noticed. Redact properly, check the final version, and have a second pair of eyes review it before it leaves.

Writing the Response

You've found the data. Now what do you actually send?

The person is entitled to a copy of their personal data. They're also entitled to some supporting information, usually covering:

• why you're processing their data
• the categories of data involved
• who you share it with
• how long you'll keep it, or how you decide
• where it came from, if not from them
• their other rights, including to complain to the ICO

If they made the request electronically, reply electronically, in a commonly used format. Send it securely. Password-protect the file and send the password separately, or use a secure portal. Sending a SAR response to the wrong email address would be a breach in its own right.

Keep the tone human. A short cover note that explains what's included, what's been withheld and why, and how to get in touch if they've got questions goes a long way. If you've redacted or withheld anything, say so. Don't leave them guessing.

Trust Keith's free DSAR response templates give you ready-made wording for the cover letter, extension notices and refusals, so you're not drafting from a blank page under pressure.

Common SAR Mistakes

After the checklists, here's what actually goes wrong.

Missing it in the first place

The request arrives in a support inbox, a salesperson's DMs or a manager's email. Nobody forwards it. By the time anyone notices, half the month's gone. Fix it with training and one clear route for everything.

Employee SARs

These often arrive in the middle of a grievance or dismissal, and the person asking has a good idea what they're after. Expect emails, chat messages and manager notes to be in scope. Trust Keith's guide to data protection for HR teams covers this in more detail.

Refusing without a good reason

You can refuse a request that's manifestly unfounded or excessive, or charge a reasonable fee, but the bar is high and you need to explain your decision. "It's too much work" on its own rarely cuts it.

Leaving it to one person

If one person holds all the knowledge of how to run a SAR and they're on holiday, the clock keeps ticking. Write the process down, and make sure someone else can step in.

Forgetting the paper trail

If the ICO ever asks, you'll want to show when the request arrived, what you searched, what you withheld and why. A simple log does the job.

Frequently Asked Questions

Quick answers to the questions that come up most.

How long do I have to respond to a subject access request?

Generally one month from receiving the request. You can extend by up to two further months if the request is complex or the person has made multiple requests, but you must tell them within the first month and explain why.

Does a SAR have to be in writing or mention GDPR?

No. A request can be made verbally or in writing, through any channel, and doesn't need to use specific words or a particular form. That's why your team needs to know how to spot one.

Can I refuse a subject access request?

Only in limited circumstances, such as where the request is manifestly unfounded or excessive, or where an exemption applies to some or all of the data. Refusals need a clear explanation and should mention the person's right to complain to the ICO.

What happens if I miss the deadline?

The person can complain to the ICO, or take court action. The ICO can investigate and use its enforcement powers. Late responses are among the most common data protection complaints, so it's worth getting your process right.

A subject access request isn't a crisis. It's a test of whether you know where your data lives and who's in charge when someone asks. Get that right once, and every request after it gets easier.

If you'd like to keep reading, these are good next steps: see what GDPR actually covers, read about managing your supplier chain so processors can help when a request lands, and check what your team needs from GDPR training so requests get spotted.

If any of this still feels uncertain, or you'd like to talk it through with someone who's handled it before, you're welcome to book some time with our team. We're happy to see how we can help.